CVE-2025-25758 - FULL DISCLOSURE

CVE ASSIGNED: CVE-2025-25758
CVE PUBLISHED STATE: PUBLISHED
CVE LINK: https://nvd.nist.gov/vuln/detail/CVE-2025-25758

Description:
An issue in KukuFM Android v1.12.7 (11207) exists due to android:allowBackup="true" being declared in the AndroidManifest.xml file. This configuration allows attackers with physical access to the device to extract sensitive cleartext information via Android Debug Bridge (ADB) backup functionality. Exploiting this vulnerability does not require rooting the device and can lead to the disclosure of critical internal application data such as shared preferences, configuration files, and local databases which contains data in cleartext.

Impact:
Unauthorized access to sensitive application data
Exposure of user credentials or authentication tokens
Violation of user privacy and data protection standards
Potential misuse of personal or application-specific information
Compromise of application security posture

Attack Scenario:
Attacker gains physical access to the Android device
Enables USB debugging
Connects the device via ADB to a computer
Executes: adb backup -f com.vlv.aravali.ab com.vlv.aravali
Extracts backup data from the KukuFM app, including: shared_prefs/, databases/ & Other internal configuration files


Technical Details:
Vulnerability Type: Incorrect Access Control
CWE Classification: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Attack Type: Local
Affected Version: 1.12.7 (11207)
Affected Component: AndroidManifest.xml (android:allowBackup="true")
Impact: Information Disclosure

Affected Products:
KukuFM Android App: https://play.google.com/store/apps/details?id=com.vlv.aravali

Vendor Information:
KukuFM
https://kukufm.com/

Proof of Concept:
Enable USB debugging on the device
Connect device to computer via ADB
Run command: adb backup -f com.vlv.aravali.ab com.vlv.aravali
Analyze extracted .ab backup file to access sensitive app data
Observe cleartext contents in shared_prefs/, databases/, etc.
PoC at - https://ibb.co/S4J4tY2N

References:
CVE-2017-16835
CVE-2023-46918

Severity:
High

Fix:
Set android:allowBackup="false" in AndroidManifest.xml to prevent unauthorized ADB backups
Encrypt sensitive data stored locally in shared_prefs and databases
Use Android Keystore for securely storing authentication tokens and credentials
Regularly audit AndroidManifest configurations for insecure flags
Apply best practices for secure local data storage and access control

Discoverer:
Ishwar Kumar